I've read the threads on escaping the parens and the such. But I'm trying to do the "]". I thought I would be able to just swap the ")" for "]" in the rex command but it doesn't work.
Line: ....[Status: 4] [myfield2: myvalue2][myfield3:myvalue3] [myfield4:myvalue4]
So I've tried the following to extract field2 as value2. The closest one I get is the first and second one. I get the field to extract, but it doesn't cut off on the "]" after it (so the values look like: myvalue2][myfield3:myvalue3] [myfield4:myvalue4])
rex field=_raw "myfield2: (?<myextractvalue2>.*)\\]"
rex field=_raw "myfield2: (?<myextractvalue2>.*)\]"
rex field=_raw "myfield2: (?<myextractvalue2>\w)\\]"
Any help would be greatly appreciated. Thanks.
Try:
rex field=_raw "myfield2:\s*(?<myextractvalue2>[^\]]*)"
or
rex field=_raw "myfield2:\s*(?<myextractvalue2>.*?)\]"
Hello,
this should do :
| makeresults
| eval someField="[Status: 4] [myfield2: myvalue2][myfield3:myvalue3] [myfield4:myvalue4]"
| rex field=someField "myfield2: (?<myextractvalue2>[A-Za-z0-9]+)"
| rex field=someField "myfield3:(?<myextractvalue3>[A-Za-z0-9]+)"
| rex field=someField "myfield4:(?<myextractvalue4>[A-Za-z0-9]+)"
Try:
rex field=_raw "myfield2:\s*(?<myextractvalue2>[^\]]*)"
or
rex field=_raw "myfield2:\s*(?<myextractvalue2>.*?)\]"
EXCELLENT!! Thank you! The second actually worked better for me. The first one sometimes cut the value for some reason. But the second one perfect!